Summary
generated automatically from NVD dataPHPix Photo Album, in versions 1.0.2 and earlier (including 1.0 and 1.0.1), contains a directory traversal flaw. A remote attacker can use a .. (dot dot) sequence to escape the intended directory and read arbitrary files on the server, with no authentication required. The CVSS v2.0 score is 5.0 (MEDIUM), reflecting a partial loss of confidentiality only.
NVD description
Directory traversal vulnerability in PHPix Photo Album 1.0.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack.
EPSS · FIRST.org
8.0%probability of exploitation in the next 30 days
Higher than 94% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 19 déc. 2000
- Updated
- 23 sept. 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (8)
- http://www.securityfocus.com/bid/1773ExploitVendor Advisory
- http://www.securityfocus.com/bid/1773ExploitVendor Advisory
Similar CVEs
Other vulnerabilities of type
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.